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ABSTRACT 


Currently, signals intelligence (SIGINT) analysts are constantly overwhelmed by 
the amount of data they ingest. A relatively new technology, known as Energy Change 
Detection (ECD), was fashioned in order to alleviate a portion of the “background noise,” 
or signals not of interest to the SIGINT analyst. ECD has been tested and its operational 
capability verified and validated by senior analysts. With the current organizational 
structure within which ECD resides, its utility to the tactical user is limited. This 
limitation affects both the timeliness of intelligence production and volume of users it can 
accommodate. An analytical model was devised to determine the sources of latency in 
response to a request for information (REI). Various obstacles are highlighted and a 
revised operating procedure was modeled. This thesis analyzes four aspects of an 
organization (task, technology, structure, and actors) and proposes a change in ECD 
implementation to affect the production of tactical intelligence. The intent of the 
revision, along with providing ECD to a tactical intelligence cell, is to allow the tactical 
commander to make more effective decisions with respect to the employment and 
deployment of forces, types of forces (kinetic versus non-kinetic) to employ, and 
maximizing the efficiency of organic intelligence collection assets. The organizational 
revision, coupled with required analyst training, allows information to be pushed to a 
tactical intelligence cell and commander within a window of six hours from collection of 
the signal. This window allows for the production of actionable intelligence, increases 
the efficiency of SIGINT analysts, and potentially drives tactical operations. 
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I. 


INTRODUCTION 


A. MOTIVATION 

The man who will go where his colors go, without asking, who will fight a 
phantom foe in the jungle and mountain range, without counting, and who 
will suffer and die in the midst of incredible hardship, without complaint, 
is still what he has always been, from Imperial Rome to sceptered Britain 
to democratic America. He is the stuff of which legions are made...His 
pride is in his colors and his regiment, his training hard and thorough and 
coldly realistic, to fit him for what he must face... and his obedience is to 
his orders. He has been called United States Marine. 

- T. R. Fehrenback, This Kind of War 

Almost seven and a half years into the Global War on Terror (GWOT), an 
inereasingly heavy burden has been plaeed on the intelligenee eommunity (IC) to provide 
timely and actionable intelligence to the tactical user. Still, in 2009, too many times on 
the battlefields of Iraq and Afghanistan have there been U.S. or Coalition casualties, 
which could have been avoided if the correct intelligence was “pushed down” to the 
appropriate tactical commander. There have been too many instances of useful 
intelligence reaching a tactical unit 24 or 72 hours late. 

The motivation behind this thesis is to provide more timely and actionable 
intelligence to tactical units worldwide by altering the organization of technology, 
personnel, and specific databases. The particular data in question will be processed 
through a relatively new technology (referred to throughout the thesis as “the process” or 
Energy Change Detection) focused on energy signatures of multiple types. This 
processed information will allow tactical users to focus and integrate organic intelligence 
collection assets. Civil Affairs Groups (CAGs), human intelligence (HUMINT) 
personnel. Psychological Operations Groups (PSYOPS), reconnaissance units, and/or 
other operational units in order to successfully complete the commander’s mission. 
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B. THESIS OBJECTIVE 


The overall goal of this thesis is the optimization of a elassic sensor-to-shooter 
information flow model. The main objectives are outlined below: 

• Analyze and model the current process of energy change detection (ECD) 
once a request for information (RFI) is sent to the queue. 

• Determine areas within the current process where optimization is possible 
and mandatory in order to provide tactical intelligence. 

• Develop a model of a proposed process capable of providing intelligence 
to conduct tactical operations in a timely manner. 

• Suggest an operating tactical unit who would greatly benefit from having 
ECD as one of its capabilities. 

• Demonstrate scenarios where ECD would be useful. 

C. OVERVIEW OF EXPERIMENTAL PLAN 

ECD will allow SIGINT analysts and military commanders alike to focus their 
assets on the mission to maximize effectiveness. According to the Code of Best Practices 
for Experimentation (COBP), discovery experiments “... may involve pure models and 
computer simulations to place the new concept in the context of other factors, or human- 
in-the-loop experiments to learn how people relate to the innovation and choose to 
employ it” (Alberts and Hayes, 2002). ECD has passed all initial experimentation, 
verification, and validation! and is being utilized operationally on a small scale. 

The COBP states: 

Even when an initial discovery experiment is successful in suggesting 
military utility and some way of employing the innovation, more research 
and discovery experimentation will usually be required to validate the 
initial finding, to refine the employment concepts, or to determine the 
conditions under which the innovation is most likely to provide significant 
payoff. (Alberts and Hayes, 2002) 

! Details of all experimentation, verification, and validation are classified. 
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A mature operating procedure does not exist for this technology yet. Ideally, as a 
technology is being developed, a standard operating procedure is being developed 
concurrently. More commonly, a new technology is developed, proven useful, and then a 
decision on the correct implementation is discussed. This is the case with many new 
technologies; a way to employ a technology effectively has not been established, nor are 
the possible implications understood at the strategic, operational, or tactical levels of 
warfare. A mature operating procedure developed now while operational use is minimal, 
will maximize the effects on the decision-maker. 

The hypothesis: If Energy Change Detection is provided to a tactical intelligence 
cell then the potential for more effective decision-making by the tactical commander 
exists, focusing the SIGINT analyst on signals of tactical interest and maximizing the 
effectiveness of organic intelligence collection assets. Figure 1 illustrates this hypothesis. 



Figure 1. Illustration of Hypothesis. 


Modeling and quantitative analysis will be used to test this hypothesis and show 

the utility of this technology at the tactical level. The current process will be analyzed. 

This analysis will then be validated by historical data (using all RFIs fulfilled in 2008) 

and verified by the analysts whom are current fulfilling all RFIs. A proposed solution 

will be modeled. A comparison of both models with respect to the time required to fulfill 

an RFI and the volume of RFIs handled per unit time will be made. Results of this 

comparison will either prove or disprove the hypothesis. 

Following this analysis, ECD will be fielded to a tactical military unit to be tested 

in real-world operations. Upon completion of that unit’s operational deployment, 

collaboration between intelligence analysts, commanders, and research personnel will 
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occur. After action reports and lessons learned will be part of the operating proeedure 
revision proeess. Onee these revisions transpire, this teehnology will be aequired and 
fielded to all relative operating forees and on the proper information dissemination 
system or systems. 

D. THESIS ORGANIZATION 

The rest of this thesis is organized as follows. Chapter II provides baekground 
information on the new technology being proposed. Various sourees of power are 
diseussed and related to an asymmetrieal adversary. It explains the differenee between 
information and intelligenee and relates these to sources of authority and elout. Also, 
Chapter II goes into detail on the implieation on the adversary’s OODA loop and the 
colleetion and storage systems form where the data is being derived from. A summary of 
Harlod Leavitt’s theory, known as the Leavitt Diamond, is submitted along with an 
explanation on the employment of his theory to LCD. This researeh will analyze and 
model various portions of the current proeess once an RFI is submitted via a tactieal user. 

Chapter III deseribes the author’s proposed solution to the lateney of the eurrent 
proeess. This proposed solution ineludes the organization of personnel and database 
management. Chapter III also deseribes the proposed taetieal unit and its intelligenee 
eolleetion eapabilities and limitations. A eomparison of the proeess frameworks, as-is 
(Chapter II) and proposed (Chapter III), will be presented in Chapter IV. Also in this 
ehapter is the quantitative analysis on the expeeted improvements to taetieal operations 
with the proposed solution. 

Chapter V concludes the thesis by summarizing the work, deseribing signifieant 
results to inelude the usefulness of the proposed proeess, and recommends future work 
necessary to validate the proposed proeess. Portions of this thesis are elassified, and as 
sueh, not ineluded in the unelassified version. Those portions are stored in the 
appropriate loeation. 
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II. BACKGROUND 


A. INTRODUCTION 

I. Sources of Information 

The cliche “information is power” is as true today as it was at the onset of 
civilization. The sharing of information seems almost counterintuitive to human nature 
because of this fact, and may very well be the underlying reason why intelligence sharing 
amongst various organizations within the IC is a topic of concern. However, sources of 
information exist everywhere; and a lot of times they exists where people least expect. 
Many essays and papers, especially in today’s world concerned with asymmetrical 
warfare^, have been written (e.g., Arquilla and Ronfeldt, 1996) on the topic of 
information as a source of power. 

The fact that information exists in non-physical matter (and more inclusively - all 
matter) is not a new concept. According to John Arquilla and David Ronfeldt (1996), 
“information, generally thought to be immaterial, is increasingly seen to be an essential 
part of all matter.” While “power, long thought to be based mainly on material resources, 
is increasingly seen to be fundamentally immaterial, even metaphysical in nature.” 
Arquilla and Ronfeldt view information in three views. Two views: 

. . . are widespread. The first considers information in terms of the 
inherent message, the second in terms of the medium of production, 
storage, transmission, and reception. The emerging third view transcends 
the former two; it speculates that information may be a physical property - 
as physical as mass and energy, and inherent in all matter. (1996) 

This third view is the focus of BCD. Considering information a physical element and 
present in all matter is a powerful concept. More powerful is the concept of information 
residing in all energy. 

Information is present throughout the entire electromagnetic (EM) spectrum. 
Figure 1 is a typical illustration of the EM spectrum with some of common bands labeled. 

^ In order to scope this thesis, the term “asymmetrical adversary” is used interchangeably with 
“insurgent” or “insurgency.” 
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Figure 2. The Electromagnetic Spectrum (From Keiner, 2009). 


As humans, we typically understand that information is contained within the visible and 
radio frequency portions of the spectrum. This is to say that what we hear and see supply 
our neurological sensors with signals that, when properly received, provide a human 
being information. We even understand the lack of energy in this spectrum range, i.e,. an 
image of a naval port without naval assets located there gives intelligence analysts a 
certain amount of information. A radio channel that is not transmitting as normal also 
provides a certain level of information. Information does not need to be contained within 
the energy (or waveform). The mere existence or absence of energy can provide an 
abundance of information. And with this information, useful intelligence may be 
derived. 
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2. 


Information as a Source of Power 


Power is the great aphrodisiae. 

- Henry Kissinger (New York Times, 1971) 

If sueh a heavy emphasis is plaeed on identifying sourees of information, then one 
ean assume that information is a souree of power. Otherwise, no one would eare who had 
aeeess to eertain eompartmented information. There are numerous definitions given to 
the term “power.” Not only are there many definitions, but there are many disciplines, 
which can be referenced with “power.” And within each discipline there are many 
distinct sources of “power.” 

Like most other entities, power can be defined in terms of quantitative and 
qualitative measurements. Quantitatively, power is the amount of work (or energy) done 
per unit time (Serway, 1996). Solar, electrical, and mechanical power are examples of 
power that can be classified as quantitative. 

A qualitative assessment of power becomes more difficult. The DIME theory 
(Diplomatic, Information, Military, and Economic) is a well-known theory to categorize 
the source of power of state actors. Military and economic sources of power can be 
quantified easily (i.e., order-of-battle and gross domestic product analysis). Diplomacy 
and amount of useful information are characteristics much more difficult to quantify. 

How does the United States match up versus a non-state actor in these categories? 
The answer is relatively simple to produce. Diplomacy is not applicable when dealing 
with non-state actors. Both militarily and economically, the U.S. dominates non-state 
actors. Then how come asymmetrical warfare is so costly for Americans? The answer 
lies in the informational realm. Table 1 below compares many factors of symmetrical 
and asymmetrical warfare. The “Key question” factor, under Information, is important in 
understanding information as a source of power. ‘"What information to get” is the focus 
vice “How to get information” (NATO, 2002). As stated earlier, the U.S. does not have a 
capability gap in the “How. ” The gap resides in the “What. ” 
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Factor 

Symmetrical, Conyentional 

Operations other than War 




Mission/Ooeration 



Stability 

Relatively stable 

May be more dynamic 

Focus 

Enemy 

No traditional opponent 

Commitment 

Common (military) 

Uncertain (political/military) 




Princioles 



Unity 

Of command 

Of purpose 

Decisionmaking 

Hierarchical 

Consensus 

Operations 

Surprise, secrecy 

Transparency 




Information 



Nature of the Problem 

Known unknowns 

Unknown unknowns 

Key question 

How to get information 

What information to get 

Focus 

Enemy military 

Military/political/economical/social factors 

Situational Awareness 

Common air-land-sea 

Limited dissemination, more complex 

Databases 

Very large, well stmctured 

Larger, less structured 




Analysis 



Unit 

Battalion level entity 

More behavioural 

Ease in integration 

Relatively easy 

Very difficult 

Focus 

Military (systems, organisations) 

Political/military and societal 

Approach 

Traditional operation analysis 

"Softer" analysis 


Table 1. Factors of Symmetrical and Asymmetrical Warfare (From NATO, 2002). 

It has been said by many military strategists, with respect to the GWOT, that “he who 
controls the people, controls the war.” This statement is true in all the current conflicts 
the U.S. military is involved. The populace is controlled by information via many 
different mediums (i.e., television, telephone, newspaper, and the internet). 

3. Information versus Intelligence 

Don't be buffaloed by experts and elites. Experts often possess more data 
than judgment. Elites can become so inbred that they produce 
hemophiliacs who bleed to death as soon as they are nicked by the real 
world. 

- General Colin Powell, USA (CJCS, 1992) 

There are many instances in our everyday lives where the terms “information” 
and “intelligence” are used synonymously. In fact, they are two distinct concepts with 
separate definitions. Joint Publication (JP) 1-02 defines intelligence as: 
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1. The product resulting from the collection, processing, integration, 
analysis, evaluation, and interpretation of available information 
concerning foreign countries or areas. 

2. Information and knowledge about an adversary obtained through 
observation, investigation, analysis, or understanding. 

Even the Joint Publication’s definition blurs the difference using the term information to 
define intelligence. Figure 3 from JP 2-01 demonstrates the joint military view of the 
transfer of information and intelligence to the decision maker. 



Figure 3. Analysis and Production Activities (From JP 2-01, III-34). 

An explanation of the various levels of understanding is provided in the information 
pyramid analysis. 

There are many information pyramids in academia, and most have three or four 
levels. The more complete versions differentiate between two types of intelligence; 
knowledge and wisdom. Referring to Arquilla and Ronfeldt’s In Athena’s Camp, the 
information described in a pyramid related to the concept of “Information as Message” 
where information is expressed as “an immaterial message or signal that contains 
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meaningful (or at least recognizable) content and that can be transmitted from a sender to 
a receiver” (Arquilla and Ronfeldt, 1996). The information pyramid is visually portrayed 
in Figure 4. 



Figure 4. The Information Pyramid (From Arquilla and Ronfeldt, 1996). 


The foundation of the pyramid is data. Data can come in many forms, i.e., digital 
cable in the form of Is and Os, recorded observation of rainfall, or facts listed in a 
Farmer’s Almanac. The conversion of this raw data to information requires organization. 
Once the data is arranged in such a way that is humanly decodable, then the 
transformation is complete. A typical example of this is taking rows of data in a 
Microsoft Excel spreadsheet and creating a chart or graph based on the data. The 
processing and exploitation activities as defined by JP 2-01 are captured in Figure 5. 



Figure 5. Processing and Exploitation Activities (Erom JP 2-01, III-29). 
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Intelligence is analyzed information. When dissecting intelligence into 
knowledge and wisdom, then knowledge is the analyzed information. Understanding 
what the information portrays is knowledge. A very important aspect of knowledge is 
that different people will have diverse levels of knowledge based on a certain set of 
information. The New York Stock Exchange trend analysis is an example of this. The 
same set of information may cause one investor to sell a stock and another to buy that 
same stock. 

The distinction between the two investors resides in their individual levels of 
experience and intellect. Combining knowledge with experience and intellect generates 
the highest level of understanding; Wisdom. Only knowledge or intelligence products 
may be created. Wisdom is used in deciphering and analyzing the intelligence through 
ones individual experiences and level of intellect. The concept of levels of information 
can be confusing and frustrating if not understood correctly. The following scenario from 
Operation: IRAQI FREEDOM (OIF) is used as an example to take the reader through the 
four stages of information. 

a. Data 

Anytime an improved explosive device (lED) is found or detonated, a 
detailed description of the event is filed in a database. Data is gathered and consolidated 
from multiple sources in the database. Some properties of the event are date, time, 
location, unit, type of lED, type of detonation, type of explosives, found or cleared, and 
casualties. All of this information is stored in a database and able to be extracted via a 
query tool. The following table is an example of lED data taken from 
http://icasualties.org and is a list of all lED fatalities by month since commencement of 
OIF through February 2009: 
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Jul-03 

4 

Auq-03 

7 

Sep-03 

6 

Oct-03 

13 

Nov-03 

20 

Dec-03 

18 

Jan-04 

20 

Feb-04 

10 

Mar-04 

20 

Apr-04 

19 

Mav-04 

26 

J un-04 

14 


Table 2. lED Data (From http;//icasualties.org). 

It is difficult to visualize what the table is telling the reader because the data is not 
displayed in an easily recognizable format. 

b. Information 

Displaying data in a chart or graph is a typical way to convert data into 
information. Visualization allows a human to take days-, weeks-, months-, or years- 
worth of data and observe points of increase and decrease, levels of stability, and relative 
number of events compared to a similar time period. From the following table, an 
individual can deduce that May 2007 had the most IFD activity to date in OIF. There are 
also other local maxima (January 2005, November 2005, and December 2007) and local 
minima (April 2006 and December 2008) that require further analysis. 
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lED Fatalities By Month 



Table 3. lED Graph (From http://icasualties.org). 

Sometimes, improper deductions are made based on a certain set of information. From 
the above table, it would be incorrect to infer that the drop-off in IFD activity from May 
2007 to the present is because the Iraqi Army has evolved into a self-sustaining 
organization able to defeat the insurgency. There are many other factors that must be 
included in an analysis of this magnitude. Carelessness in assumptions may lead to 
incorrect analysis of the data and information. 

c. Knowledge (Intelligence) 

Analyzed information is commonly referred to as intelligence. As stated 
above, intelligence will be broken into two sections; knowledge and wisdom. Combining 
the information provided above with other sources of information (i.e., a human 
intelligence report from the same time frame) is critical to converting the information to 
intelligence. Table 3 above does not give much insight into the various population 
centers throughout Iraq. The following six figures from http://icasualties.org show the 
IFD events by geographic location and year. 

An example of knowledge gained from the above information example is 
the heavy concentration of IFD events in A1 Anbar up through 2006 and Baghdad up to 
2007. A decline in IFD events after 2007 suggests either another form of attack is 
becoming the primary insurgent tactic or the increase in number of U.S. Military 
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Servicemen, known as “The Surge,” is helping to turn the tides. This information may be 
used to deploy forces where lED events occur most frequently. One can also see the 
trend of increasing lED events after 2006 to other regions of the country. Providing the 
analyst a better understanding of the situation is possible by combining this knowledge 
with other sources of intelligence, such as human intelligence or SIGINT. Intelligence 
must be fused from multiple sources to reach its full potential. 
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Figure 6. lED Fatalities in 2003 (From http://icasualties.org). 
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Figure 7. lED Fatalities in 2004 (From http://icasualties.org). 
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Figure 9. lED Fatalities in 2006 (From http://icasualties.org). 



Figure 10. lED Eatalities in 2007 (Erom http://icasualties.org). 
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Figure 11. lED Fatalities in 2008 (From http://icasualties.org). 


Questions an analyst will ask him/herself include “VFhy is there a spike in 
activity in this year?” or '"How were X number of lEDS detonated in area A vice area B?” 
Coalition operations, religious holidays or events, or regional politics may be the answer 
or provide more information to arrive at the correct answer. A limited background in the 
topic under analysis may lead to an incorrect analysis of the information. This will 
produce an intelligence report that lacks credibility and is rendered useless in the eyes of 
the IC and a tactical commander. A tactical commander may have too much faith in the 
analysis conducted, forming a situation where tactical operations are conducted on faulty 
intelligence. 


d. Wisdom 

Knowledge will vary from person to person, as will wisdom. Wisdom is 
an individual’s ability to apply analyzed information to personal experiences in the field 
of study along with an in-depth intellect in the subject area. Wisdom requires the 
accumulation of time with respect to a given subject area. An analyst in Washington 
D.C. with no operational experience in Iraq will interpret and analyze information and 
intelligence differently than an analyst who is currently on their fourth deployment in 
support of OIE. 
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With the above Iraq example, an in-depth understanding of the main 
supply routes, eoalition aetivity, and loeal religious or politieal agendas may persuade the 
analyst to believe “The Surge” was the reason for reeent sueeess. Someone with 
operational experienee would attribute the reeent sueeess to the Marines and soldiers 
embedded with Iraqi Seeurity Forees. Their mission to advise, mentor, and train the ISF 
laid the foundation for “The Surge” to be effeetive. This wisdom would not be possible 
without the operational experienee neeessary to understand the differenee between Iraqi 
and Western eulture. 


e. Impact of ECD on the Information Pyramid 

BCD is a new method of signals information that displays relative 
information and attempts to mask the extraneous aetivity. ECD by itself does not 
produee intelligenee. This new visual representation of emitters will permit SIGINT 
analysts to not only foeus on signals of interest, but also a trend analysis on signal 
patterns in a speeifie area of operations for a given time interval. Foeusing on signals of 
interest alloeates more of the analyst’s time to useful work, not wasting time on signals 
whieh are not important to the mission. Condueting a trend analysis on the visualization 
of signal patterns will provide the taetieal eommander an insight into the seleetion and 
utilization of forees. Both provide intelligenee to the taetieal eommander that will aid in 
mission sueeess. 

4. OODA Loop 

Without our genetie heritage, eultural traditions, and previous experienees, 
we do not possess the implieit repertoire of psyehologieal skills shaped by 
environments and ehanges that have been previously experieneed. 

- Colonel John Boyd, USAF (The Essenee of Winning & Eosing, 1995) 

Colonel John Boyd, USAE, developed the OODA (Observe-Orient-Deeide-Aet) 
loop originally to deseribe the deeision eyele a fighter pilot eonstantly undergoes in aerial 
eombat. Beeause of the speed at whieh these engagements oeeur, the pilot must maintain 
fluid, speedy eyele. Colonel Boyd showed many instanees throughout history where the 
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OODA loop framework could describe all levels of warfare. He also “saw it deeply 
relevant to any kind of competitive environment; business, politics, sports, even the 
struggle of organisms to survive” (Greene, 2007). Figure 12 is a simplistic illustration of 
Colonel Boyd’s conceptual loop and Figure 13 is a more detailed drawing. 



Figure 12. The Simplistic OODA Loop (From Greene, 2007). 



Observations are derived from all senses at the commander’s disposal. The 
observations portray a visual image to the commander of the current situation, known as 
“ground truth,” allowing that commander to orient to a given situation based on past 
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observations. A decision is formed and then acted upon. This action (and decision) 
creates new observations which then begin the cycle anew. Greene describes the main 
elements as (Greene, 2007): 

• Observations originate from human sources as well as from data, test 
results, intelligence sources, and models about a situation. 

• The goal of orientation is to make sense of the observations. 

• Making a decision is not a single action, but is a process of repeatedly 
deciding what to do next—observe more information, do further 
orientation, or take action. 

• The proof of the success of the OODA loop is in the success of the action 
taken. 

An OODA loop is inherent in every decision-maker. The goal for a commander 
is to make their OODA loop run as efficiently and quickly as possible. In military 
conflict, it is imperative to force your adversary to react to your operations. This is 
accomplished by allowing your OODA loop to operate inside your adversary’s OODA 
loop. Due to greater latencies in the adversary’s loop then the friendly loop, the 
adversary’s decisions are now based on observations of friendly operations. 

Compelling an asymmetrical adversary to be reactive vice proactive is critical to 
mission success. An asymmetrical adversary’s center of gravity is the ability to gather 
and control information. This makes it difficult for coalition forces to operate in various 
geographic regions of conflict. Interfering with an insurgent’s ability to operate 
effectively is directly related to the capability of the U.S. military to insert itself in the 
adversary’s OODA loop. An insurgency will not have the resources or motivation to 
continuously react to U.S. military operations. 

Properly implemented, BCD is a tool that will enable tactical commanders to 
conduct proactive operations in order to inhibit the insurgency’s OODA loop. BCD by 
itself is inadequate to provide useful intelligence. It must be combined with various other 
assets. Bmplacement at a tactical intelligence cell will aid in focusing intelligence 
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collection assets on newly acquired areas of interest (AOI), or reinforce current 
situational awareness of previously identified AOI’s. 

Greene’s expanded OODA loop is depicted below. 



Figure 14. The Expanded OODA Loop (From Greene, 2007). 

With respect to observations, ECD will allow the tactical analyst to observe information, 
and most notably trend analysis, in a different approach. This approach has the potential 
to orient the commander’s attention to specific geographic locations and track insurgent 
trends. Following this orientation would be the decision to deploy forces based on a 
fusion of intelligence from various sources. 

5. Tactical Need 

Signals intelligence (SIGINT) is an intelligence discipline where the collection of 
raw data is rarely scarce, and more accurately, overly abundant. Having the manpower 
present to deal with this dilemma is a constant struggle within the SIGINT community. 
Mr. John Abe best describes this in a situation: 

How many signals are active in a 200 mile radius surrounding Frankfurt, 
Germany? Hundreds? Thousands? Now, add one more signal which 
happens to be one used by a terrorist communicating with other members 
of his cell. What are the chances of detecting the new signal within the 
first few seconds? The likelihood of detection is very low. In fact, 
detecting and identifying the signal as new is very unlikely even if the 
signal were up for five minutes or more. (Abe, 2005) 
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A technology exists that will have a significant impact on not only SIGINT specialists but 
also other operational units. As a decision support tool for the commander, it 

• Aids SIGINT analysts in determining which signals are important and 
therefore need to be further analyzed 

• Assists the decision-maker with respect to force selection and utilization. 

The positive impact on the decision-maker will allow for more informed decisions on 
employment and deployment of forces, which type (kinetic versus non-kinetic effects) of 
forces to employ, and how to maximize the utilization of organic intelligence collection 
assets. However, like all technology, it must be properly implemented at the appropriate 
level of command and on the appropriate information dissemination system. 

6. Signals Data Collection and Storage 

This section is located in a classified appendix. 

7. Leavitt’s Approach to Organizational Change 

Harold J. Leavitt, the Walter Kenneth Kilpatrick Professor of Organizational 
Behavior emeritus at the Stanford Graduate School of Business and a “pioneer in the 
development of the academic field of organizational behavior” (Homgren, 2007). His 
model articulates the interrelationships between tasks, structures, personnel, and 
technology within an organization. Figure 15 is a general illustration of the Leavitt 
Diamond. 


Structure 



Figure 15. The Leavitt Diamond (From Homgren, 2009). 
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This change in technology will affect the personnel and structural organization, along 
with certain tasks that must be accomplished. Organization and workflow optimization 
are paramount in creating a streamlined operating procedure. 

The focus of this experiment is relocating BCD to a tactical intelligence center in 
order to maximize the efficiency of organic collection assets and assist the commander in 
maximizing the effectiveness of forces. Consistent with Leavitt’s model, once this 
relocation occurs (a change in technology), the remaining attributes of the diamond must 
be reviewed, and most likely altered, to ensure the organization is optimized with respect 
to efficiency of assets and effectiveness of forces. This reorganization will allow for the 
production of tactical intelligence in a timely manner. 

B. CURRENT ENERGY PROCESS ARCHITECTURE 

For all intents and purposes, the current process architecture can be simplified and 
analyzed as a two-phased process. Because of the need to maintain a queue for the RFIs, 
queuing theory is also used for analysis purposes. Appendix A diagrams the complexity 
of the process, beginning with the RBI submittal by a user in an operational theater. The 
process concludes once the RBI is fulfilled and returned to the originator. 

1. RFI Submittal and Reception 

The first phase commences when an RFI is submitted from theater and ends when 
the RFI is received by Analyst 1 (referred to as Al). Because BCD is in its infancy, it 
does not have a mature operating procedure, and therefore resides in an organization 
lacking 24/7 operations. This fact is detrimental to the timeliness of the entire process 
and is one reason why it cannot routinely produce tactical intelligence. 

Since this organization is not conducting 24/7 operations, a probabilistic analysis 
of when the RFI is actually received by Al is necessary. Al works from 0700 to 1700, 
Monday through Friday, every week. Since a weekly routine is the first periodic unit of 
measure in Al’s work cycle, all probabilistic outcomes will be in reference to a weekly 
schedule. The week is divided into 168 hours and in any one of these hourly timeslots an 
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RFI may be sent from theater to arrive in Al’s inbox within minutes. All hourly 
timeslots, their assoeiated latency for RFI reception, frequency of occurrence in a given 
week, and probability are presented in Appendix B. 

The first step is finding the probability of A1 receiving an RFI during normal 
working hours. Since A1 works ten hours per day, there are fifty hours per week in 
which A1 receives an RFI within one hour. These are considered the best case scenarios 
because the latency due to an RFI sitting in a queue is minimal. “Within the hour” 
assumes that A1 has other distractions (coffee breaks, bathroom breaks, lunch, etc.) and 
daily tasks of a higher priority. Making these assumptions, an RFI received within one 
hour of AI arriving to work will also be included with normal working hours. This 
means there are fifty-five hourly slots per week in which an RFI will be received during 
normal working hours. 

The next-best case scenario is when and RFI is submitted during non-working 
hours from Sunday evening through Thursday evening. His scenario is when an RFI is 
received after the close of the business day with the next day being a normal business 
day. If an RFI is received during this time period, a latency of anywhere from one to 
fourteen hours is possible. There are thirteen hours a day for five days during a normal 
working week where this is the case. This scenario accounts for sixty-five hourly slots 
per week. 

The remaining forty-eight slots occur over the weekend; from 1700 Friday 
evening through Sunday afternoon. This is the worst-case scenario where the latency 
range is from fourteen to sixty-two hours before A1 receives the RFI. Table 4 is the 
probability distribution per hour during one week when an RFI could be received. 
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Table 4. Probability Distribution for Weekly RFI Reception. 


The table shows a large discrepancies of possible values; an RFI can be received 
anywhere from within the first hour it was sent to sixty-two hours afterwards. Three 
focus areas are observed relating to the three scenarios described above. What is not 
overtly obvious from the previous table is that these areas are relatively equal time 
distributions. Figure 16 is a visual representation of the time distribution into these 
distinct categories. 



Figure 16. Scenarios of RFI Reception. 


From this pie chart, one can clearly see that the probability of RFI reception 
within one hour, between two and fourteen hours, and greater than fourteen hours are 
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relatively equal. That is to say, if an RFI was submitted at a random time, that RFI has 
approximately 33% probability of falling into any of the three seenarios. As previously 
stated, this lateney in time is not a oharaeteristie of taotieal intelligenee; and therefore 
needs to be eliminated. 

From a probability distribution, an expeeted value ean be determined. This 
expeeted value is more eommonly referred to as the average, or mean. The mean value is 
also denoted as p. The expeeted value, E(X), is eomputed by (Balakrishnan, 2007).3 

E{X) = f^X,P{X,) (2.1) 

1=1 

In this equation, X is the time interval required before an RFI is reeeived and P(X) 
is the probability of RFI reeeption during the time interval X. X and P(X) for this phase 
are loeated in Appendix A. The expeeted value of X is 14.4 hours. 

Assoeiated with the expeeted value of a probability distribution is the varianee 
and standard deviation. Varianee is defined as 

n 

Variance = <7^ = -E(X)f P(X.) (2.2) 

i=l 

and the standard deviation is the square root of the varianee, denoted as a. For phase one 
of the eurrent proeess, the varianee is 300.8 and the standard deviation is 17 hours and 21 
minutes. A large g is indieative of a well spread probability speetrum and degrades the 
importanee of the mean value. In this ease, g is larger than p. Falling within one g of 
the mean value aeeounts for approximately 68.26% of all values of X. For this phase, 
falling within one g of the mean value is anywhere between zero (eannot aeeount for 
negative time) and 31 hours and 45 minutes to reeeive an RFI. The following table is an 
area visualization of the probability distribution with the mean (red dashed line) and one 
standard deviation (yellow dashed line) elearly outlined. 


^ All equations throughout Chapter II and III, unless otherwise stated, are from this source. 
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Ciuient Process Phase 1: RFI Reception 



Tune (Hours) 

Figure 17. Phase 1 Probability of RFI Reception. 

2. Analysis and RFI Fulfillment 

The second phase of the current process begins once the RFI is received by A1 
and concludes once the RFI is fulfilled and sent back to the RFI originator. This process 
is quite complex and involves interactions between A1 and Analyst 2 (referred to as A2) 
and is diagramed in Appendix A. This phase is also known as the production and 
dissemination phase. 

Once an RFI is received, A1 sends the RFI to A2 so that A2 can setup the 
equipment to conform to what type of information is requested. Once the equipment 
setup is complete, A2 creates the desired report. This report is sent to A1 who reviews 
the report, checks it for accuracy, and formats the report per the RFI. Once formatted, A1 
sends the requested information to the RFI originator. 

In discussing the process during initial review, A1 declared that an RFI can be 
fulfilled (once received) anywhere from twenty minutes to six hours. Instead of 
analyzing each individual interaction between A1 and A2, it is sufficient for the purpose 
of this analysis to view the second phase as one process. This is because the time scale is 
much smaller than the time scale of the first phase (minutes vice hours). Since the 
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latency of the overall process is of greatest importance, the individual interactions do not 
need to all be considered. However, priority of request will be considered when 
discussing queuing theory. 

Since an RFI can be fulfilled anywhere within twenty minutes and six hours 
(based on priority of request and other daily tasks), it is safe to assume a general 
distribution of this phase. With the given range and knowledge of the work ethic A1 and 
A2 possess, p, is assumed to be 120 minutes, or two hours. Collaborating with Al, a a of 
forty-five minutes is accurate, meaning 68.26% of all RFIs are fulfilled between 75 
minutes (one hour and fifteen minutes) and 165 minutes (two hours and forty-five 
minutes). Figure 18 shows the normal distribution of this phase with the mean (red 
dashed line) and one standard deviation (yellow dashed line) clearly outlined. 


Ciinent Process Phase 2; Production and Dissemination 



Figure 18. Phase 2 Normal Distribution. 


3. Total Latency in the Current Process Architecture 

The combination of both phases corresponds to the total latency of the current 
architecture. A simple summation of the mean values and variances from both phases is 
sufficient to describe the entire process. 

I^totai = Al + A 2 = 14Ahours + Ihours -16Ahours (2.3) 
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Variance^^i^i = = 300.8 + (2e = 300.8 


(2.4) 


From the variance, the overall a can be calculated by 



(2.5) 


The following figure is the probability distribution curve of the entire process with the 
mean (red dashed line) and one standard deviation (yellow dashed line) clearly outlined. 


Total CiiiTent Process 



i ? 9 13 17 21 25 29 33 37 41 45 49 53 57 61 65 69 73 


Time (Hours) 


Figure 19. Overall Probability Distribution. 


It is evident from these calculations that the system is not tailored for tactical 
intelligence dissemination. In a best-case scenario; however, an RFI may be fulfilled and 
disseminated within an hour, and therefore would aid a tactical military commander. 
These instances would rarely occur, and most likely only be used for an RFI of the 
highest priority. An example of this would be a time-sensitive target of a high-value 
individual. This RFI would come from the highest level of authority, and would be the 
focus of effort for both A1 and A2. 

Currently, high priority tactical operations may occur simultaneously in multiple 
theaters. Because there are only two dedicated analysts, they may only be able to assist 
one of the operations. Thus far, the mean values and standard deviations have all been 
calculated based on one RFI. What if more than one RFI is received within a given 
timeframe? This is the case with the current process, and queuing theory needs to be 
analyzed. 
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4. Queuing Theory 

In order to apply the eorreet queuing model, various assumptions must be made. 
These assumptions are (Balakrishnan, 2007): 

• Arrivals that follow the Poisson probability distribution. 

• First in, first out (FIFO) queue diseipline. 

• A single-phase serviee faeility. 

• Infinite, or unlimited queue length. That is, the fourth symbol in Kendall’s 
notation is oo. 

• Serviee systems that operate under steady, ongoing conditions. This 
means that both arrival rates and service rates remain stable during the 
analysis. 

Poisson probability distribution has assumptions discussed in the following 
section. FIFO, for the purpose of this analysis, is assumed. This assumption has been 
confirmed by Al. There are instances where FIFO is not followed; an example is when a 
high priority operation is being planned. When this occurs, all analysts are dedicated to 
this operation, disregarding FIFO. However, these occurrences are rare enough that over 
a long enough period of time, FIFO is the mean behavior. 

Because all the processes involved are linear and dependent on completion of the 
previous process, it can be assumed a single-phase facility. Similar to the rationale for 
FIFO, occurrences where this process is viewed as multi-phased are limited and scarce. 
There is no limit to the RFI queue. 

Steady state conditions are assumed over the entire analysis. The state of military 
operations throughout the world will dictate the definition of steady state condition. 
Current operations have been ongoing well before the beginning of this analysis and can 
be considered steady state. Before these assumptions are verified, the Poisson probability 
distribution and Kendall’s notation are discussed. 
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a. Arrival Characteristic—Poisson Probability Distribution 

Confirmation of four assumptions is necessary to utilize the Poisson 
probability distribution. These assumptions are (Balakrishnan, 2007): 


• The average arrival rate (A.) over a given interval is known. 

• This average rate is the same for all equal-sized intervals. 

• The actual number of arrivals in one interval has no bearing on the 
actual number of arrivals in another interval. 

• There cannot be more than one arrival in an interval as the size of 
the interval approaches zero. 


All these assumptions are valid for the current process and the discrete Poisson 
distribution is provided by the following formula 


P{X) = 


X! 


( 2 . 6 ) 


where X is the number of arrivals per unit time, P(X) is the probability of exactly X 
arrivals, A, is the average arrival rate, and e is the exponential constant. In order for this 
formula to be accurate for the current process. A, must be defined. 


From 2008 historical data, 1,045 RFIs were submitted and fulfilled. 
Dividing the number of RFIs per year by the number of days per year produces about 
2.86 RFIs received per day; or twenty received per week. Since the unit of time used is a 
week. A, equals twenty. Figure 20 is the Poisson distribution for the current process. 
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Ciuxent Process: Poisson Distribution 
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Figure 20. Poisson Distribution for the Current Process. 


b. Queuing System Characteristics — Kendall’s Notation 


In queuing theory, there is a commonly used three- or five-symbol 
notation to organize the various types of systems. The notation is defined as 
(Balakrishnan, 2007)"^: 

A/B/s. 


Where 


• A = the arrival probability distribution. Typical choices are M 
(Markovian) for a Poisson distribution, D for a constant or 
deterministic distribution, or G for a general distribution with 
known mean and variance. 

• B = the service time probability distribution. Typical choices are 
M for an exponential distribution, D for a constant or deterministic 
distribution, or G for a general distribution with known mean and 
variance. 

• s = the number of servers. 

4 Balakrishnan uses the three-symbol viee the five-symbol notation. Only three-symbol notation will 
be used throughout this thesis. 
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The last two symbols identify the maximum allowable length of the queue and the size of 
the arrival population. The omission of these two symbols implies both eriteria tend 
towards infinity (Balakrishnan, 2007). 

The eurrent proeess is best represented by an M/G/1 system. As stated 
above, the arrival of RFIs is a Poisson probability distribution, the service time is 
represented by a general distribution with a known (assumed) mean and variance, and the 
number of servers is singular. The product A1 and A2 collectively assemble is a linear 
process and thus represented as a single server. Multi-servers indicate that an RFI would 
go to either A1 or A2 for fulfillment, and this is not the case. 


c. Queuing Computations for the Current Process Architecture 

For computations involving an M/G/1 system, the average number of 
arrivals per time period (A,), the average number of people or items served (\|/), and the 
standard deviation (a) are essential. From previous calculations. A, = 20 arrivals per 
week, \)/ = 21 products per week, and a = 0.75 hours (0.00446 weeks). It is important to 
note that the service rate must be greater than the arrival rate, otherwise the queue would 
tend towards infinity. With these values of A,, \|/, and a, the following six computations 
encompass the operating characteristics of this M/G/1 model (Balakrishnan, 2007): 


Average server utilization time: 

p = —= 0.952 = 95.2% (2.7) 

W 

Average number of customers or units waiting in line for service: 

= (2.8) 

' 2(l-p) 

Average number of customers or units in the system: 

L = fy+/7 = 10.05 (2.9) 

Average time a customer or unit spends waiting in line for service: 

L 

Vfy = — = 0.A55weeks = 3.2days (2.10) 

A 

Average time a customer or unit spends in the system: 
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( 2 . 11 ) 


W = W^+ = 0.5weeks = 3.5days 

Probability that there are zero customers or units in the system: 

p^=l-p = 0.048 = 4.8% (2.12) 

From these calculations, the current process maintains about nine RFIs in 
the queue at any given time, and total of ten RFIs (nine in the queue and one in 
production) are constantly in the system. The average server utilization time describes 
the amount of time that A1 and A2 are working an RFI. Because there are other daily 
tasks associated with their jobs, the other tasks have already been taken into account 
when calculating the second phase of the current process. Po conveys that the model has 
a low probability (less than five percent) of ever being void of RFIs that require attention. 

The values of Wq and W reveal the true message of the current BCD 
process analysis. Unless there is a high priority operation, an RFI will spend in excess of 
three and a half days in the system. This calculated value is optimistic because A1 stated 
that the average time to fulfill an RFI was approximately five days. This latency in 
fulfillment is not suitable for an RFI to be submitted with the intent of providing tactical 
intelligence, since actionable tactical intelligence is associated with timeliness. The 
proposed architecture will provide users with all the same intelligence they can currently 
acquire through submission of an RFI, but will also include a capability to acquire timely 
intelligence to provide useful insight to tactical commanders prior to conducting 
operations; no matter how high the priority of the operation. 

C. SUMMARY AND CONCLUSIONS 

The current process architecture cannot provide timely intelligence to a tactical 
user nor can it fulfill a high volume of RFIs based on the personnel and organizational 
structure. This initial structure served as the experimental test bed for this technology. 
Now, the technology has proven useful and requires a mature operating procedure to 
efficiently service users at every level of warfare. The following characteristics of the 
current process are areas of possible improvement with respect to the production of 
tactical intelligence. 
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The current process was established as a test bed for verification and validation of 
BCD technology. While BCD has proven useful to fulfilling RBIs on the time scale 
involving days, a timeline on the order of hours and minutes is not feasible in the current 
architecture. Appendix C is a PowerPoint presentation, created by the author, given to a 
senior executive with the intent of demonstrating the feasibility and tactical utility of 
BCD. The presentation was given on Bebruary 26**^, 2009. The following five sections 
list and explain the areas of latency in the current process. Providing senior leadership 
metrics and avenues of improvement will allow for funding and expedited 
implementation of this technology at the tactical level in support of the GWOT. 

1. Information versus Intelligence 

Differentiating between information and intelligence has been done in a previous 
section. Currently, an RBI must be fulfilled with a fully vetted intelligence report, with 
few exceptions. This is not driven by policy, but is a function of what information a 
specific RBI is requesting. An intelligence report is more time consuming than merely 
providing information to the requestor, because intelligence requires a certain level of 
analysis. In many cases, if just the information was provided to the RBI originator, that 
unit can conduct its own analysis and produce its own intelligence. There are situations 
where a military unit has the organic intelligence assets necessary to gather their own 
intelligence with a “tip off’ from the information provided by the strategic operations 
center. These changes would allow for a higher volume of RBIs to be fulfilled and 
decrease the amount of time it takes to fulfill a request. 

2. “Pushing” versus “Pulling” Information 

In order for the current process to initiate, the system requires submittal of an RBI 
via a member of the tactical unit in a theater of operations whom desires the information 
(the RBI originator). Before an RBI is submitted, the RBI originator needs access to the 
Joint Worldwide Intelligence Communications System (JWICS) and an understanding of: 

• The observed intelligence gap that could be detrimental to mission 
success. 
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• What information is required to fulfill this gap. 

• The capabilities and limitations of this technology. 

• The EM spectrum and what information it can provide. 

Once all these stipulations are met, than the tactical unit “pushes” an RFI to the 
operations center where this technology currently resides. Once A1 and A2 complete the 
necessary analysis to fulfill the RFI, the final intelligence product is than “pushed” back 
to the RFI originator. This is equivalent to having to “pull” the required information 
from the operations center. If there is any rework required, or the findings of the RFI 
give birth to new questions, than another RFI must be submitted. 

A solution to decrease the latency in the process would be to constantly “push” 
the information to units at all levels periodically, partitioning the information based on 
geo-location of the military unit. If military units were periodically receiving pertinent 
information based on their area of operations, their indigenous intelligence cell could, in 
most cases, provide the required analysis on the information to provide timely and 
actionable intelligence to the commander. This information would also provide the 
intelligence cell information necessary to more efficiently focus their organic intelligence 
collection assets. 

3. Bottleneck 

Anyone worldwide, with access to JWICS (or access to a HHQ with JWICS), can 
submit an RFI. Since there are only two analysts currently assigned to this technology, 
an informational bottleneck occurs. Tactical operations in various theaters across the 
globe prioritize intelligence requests based on the current mission in their respective 
theater. Different theaters have a higher priority than others. Since all the RFIs are sent 
to a single strategic-level operations center and placed in a queue, the relative importance 
of the information requested does not matter. An obvious exception to the rule would be 
a tactical operation with strategic implications, and this category of operation is usually 
time-sensitive. Even though an RFI in one theater might be of higher priority than 
another RFI in a separate theater does not mean the queue will acknowledge this, unless 
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(as previously stated) there are strategie level implieations. There needs to be a way to 
geographieally separate the information in order to prioritize requests. 

4. Human-in-the-Loop 

Human analysis at the strategie level is not neeessary if BCD is loeated at the 
taetieal level. Onee BCD “pushes” the information to the taetieal user, organie 
intelligenee analysts ean use the information appropriately. Bliminating the need to 
produee fully vetted intelligenee reports ereates an arehiteeture where the human 
involvement tends to zero; exeept for when the information needs to be analyzed. 
Implying that the human ean be fully removed from the model is ineorreet, as there will 
always need to be someone eondueting routine and ad hoe maintenanee on the hardware. 
However, for the purpose of this thesis, eomplete removal of the human-in-the-loop with 
respeet to daily tasks is possible, and reeommended. Again, this ean only be 
reeommended if the final BCD produet is not a vetted intelligenee report, but an 
information “push.” 

5. Clearance and Access 

Currently, BCD only resides on JWICS. This limits the number of potential users 
to only those who have the appropriate elearanee level and aeeess to high-side systems. 
This is not always the ease in an operational environment. A eommon axiom realized by 
military veterans of Operation: IRAQI BRBBDOM and Operation: BNDURING 
BRBBDOM (OIB and OBB) is that “the war is fought on the SIPRNet.” 

During OIB, the author was deployed to a forward operating base (BOB), whieh 
did not have direet aeeess to JWICS. If BCD was available on JWICS during this 
deployment, the author would have needed to send an RBI to his higher headquarters 
(HHQ), who in turn would have had to send the BCD RBI baek to CONUS. Onee the 
RBI was fulfilled, it would have been sent baek to HHQ who would then have to reformat 
the produet to transfer from JWICS to Seeret Internet Protoeol Router Network 
(SIPRNet). Onee reformatted, then it eould have been sent baek to the author, with 
obvious time delays. There are obvious time delays with the extra steps detailed above. 
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The scenario described above would not have been feasible to produce tactical 
intelligence for the author. However, if BCD resides on JWICS and the SIPRNet, the 
potential number of users would increase. If the war is fought on the SIPRNet, then BCD 
should be applied appropriately. 
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III. PROPOSED ENERGY PROCESS ARCHITECTURE 


A. OVERVIEW 

The proposed process will mitigate many of the sources of latency detailed in the 
previous section in order to allow for the production of tactical intelligence. ECD will 
also be a tool which the tactical commander can use to pull timely and actionable 
information. Cloud computing is the backbone of the proposed solution with various 
regional hubs with service to distinct areas of operations. 

1. Database and Storage 

The data stored and archived in the database will be geographically partitioned 
into various regions of the world. This is a shift from the classic hub and spoke model, 
seen in Figure 21, to a more distributed hybrid of a hub and spoke model. 



Figure 21. Hub and Spoke Database Architecture. 

In the hybrid model, the databases are geographically disbursed and interconnected with 
all other database hubs. Users at each geographic location will have access to all 
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pertinent data. The hybrid database arehitecture alleviates the bottleneek, deseribed in 
Chapter II, of worldwide users requesting information from one database. Displayed in 
the next figure is the hybrid arehitecture concept. 



Figure 22. Hybrid Hub and Spoke Database Architecture. 


Also evident from the above figure is the number of users who can have simultaneous 
access to the data. Multiple users in multiple theaters may now use the data for 
informational and intelligence purposes without submitting an RFI to CONUS. This data 
“push” to various locales worldwide versus the RFI submittal process was noted as one of 
the sources of hindering tactical intelligence production. 

The current architecture resides on JWICS. The proposed architecture also 
resides on JWICS; however, it also has a mirrored architecture on the SIPRNet. Figure 
23 shows two hybrid architectures, one for each information dissemination system. This 
model shows that every node with JWICS access will also have SIPRNet access. 
However, the converse is not true. There are many locations in support of OIF and OFF 
where there is SIPRNet acces, but no JWICS access. These two dissemination systems 
are not linked and have no cross-domain transfer capability. 
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Figure 23. The Proposed SIPRNet (Red) and JWICS (Orange) Architectures. 

Another observation of the current architecture was that BCD is limited to JWICS 
users. Existing on the SIPRNet will provide access to more users simply because more 
personnel have secret clearances. The overlap seen above demonstrates that not all 
regional hubs will have access to JWICS. Some areas or operations are too remote for 
JWICS access. No matter how remote, military personnel should have access to the 
information BCD provides. 

A level of fidelity is lost in the data that resides on JWICS and also resides on the 
SIPRNet. However, the relevant data necessary for the tactical commander to use in 
determining the employment and deployment of forces is contained in the SIPRNet 
database. What is lost is the ability to conduct an in-depth analysis of the signals of 
interest. The equipment necessary for a more comprehensive analysis only resides with 
units that have direct access JWICS. The tactical commander would have the reach-back 
capability to HHQ with JWICS, if the need for this level of analysis exists. 
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2. Cloud Computing 

Cloud computing has an abundance of definitions. This is a fairly new and 
evolving technology and is integrated into the database architecture in the above section. 
As Erdogmus states: 

Aceording to Wikipedia, cloud computing refers to the use of sealable, 
real-time, Internet-based IT services and resources, incorporating beyond 
[software as a service] many key technology trends of the 2000s. These 
trends include . . . service-oriented architeeture, applieation serviee 
provision, Web 2.0, Web services, mash-ups, utility computing, autonomic 
computing, grid computing, on-demand computing, and so on. . . . 
Matthieu Hug’s alternative definition on InfoQ (www.infoq.com/articles/will- 
meis-replace-extranets) is . . . “an emerging computing paradigm where data 
and serviees reside in massively sealable data eenters and can be 
ubiquitously aceessed from any connected devices over the Internet. 
(Erdogmus, 2009) 

These varying definitions provoked Erdogmus to ask a “cloud-computing pundit for the 
real story: Marin Eitoiu of York University” and as maintained by Eitoiu, “cloud 
computing is an emerging computational model in whieh applications, data, and IT 
resources are provided as serviees to users over the Web” (Erdogmus, 2009). 

Important to note is that the proposed database arehiteeture and integration of 
cloud computing is already occurring. It is not the intent of the author to be credited with 
the transformation to cloud computing, for that transformation is independent of ECD. 
ECD will be one of many applications. Eor all intents and purposes, this thesis focuses 
on an ECD application as the proposed solution that will exist in “the cloud.” 

3. ECD Application 

As an application, the user will see two main seetions on the computer monitor. 
These two sections are the query window and map. The map will display the geographie 
area of interest and can be zoomed in and out. The query window will allow the SIGINT 
analyst to foeus on partieular signals of interest (SOIs) within a given time interval. The 
actual query sets are not listed here due to classification. The following figure is a 
cartoon rendition of the ECD application graphical user interfaee. 
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Figure 24. BCD Application Graphical User Interface. 


4. Required Training 

With the introduction of any new technology, a training regimen must be crafted 
concurrently in order to increase the effectiveness of said technology to the specific 
organization. This is a major pillar in Leavitt’s Diamond and described in Chapter II. 
The details of the training process will be assembled by the SIGINT professionals whom 
currently are testing BCD and are not in the realm of this thesis; the author does not have 
the technical expertise or background to create this training curriculum. 


5. Latency and Queuing Theory 

a. Total Latency for the Proposed Process Architecture 

The proposed process can be viewed as a single phase system conducting 
around-the-clock operations. BCD will be operational 24 hours per day by a single 
individual. Current military operations mainly use either two 12-hour shifts or three 8- 
hour shifts by individuals to cover 24 hour manning. Slightly compressing the timeline 
from the current process proposed by A1 and A2 is possible due to: 

• The analyst’s familiarization of the EM environment in a given 
area of operations. 

• Focus on a relatively small (versus worldwide) geographic area. 
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• The analyst’s speed and efficieney due to constant exposure to the 
BCD tool. 

For the proposed process, p is assumed to be 105 minutes, or one hour and forty-five 
minutes and g is also compressed to thirty minutes. This means 68.26% of all products 
are disseminated between 75 minutes (one hour and fifteen minutes) and 135 minutes 
(two hours and fifteen minutes). Figure 25 shows the normal distribution of this phase 
with the mean (red dashed line) and one standard deviation (yellow dashed line) clearly 
outlined. 


Total Proposed Process 



1 15 29 43 57 '1 85 99 113 127 141 155 169 183 197 

Time (Minutes) 


Figure 25. Proposed Process Normal Distribution. 

b. Queuing Computations for the Proposed Process Architecture 

The proposed process is best represented by an M/G/1 system, as is the 
current process. The average number of people or items served (\|/) is computed by 
taking the average time to produce an artifact based on a 24-hour operations center. At 
the average time of 105 minutes, just over thirteen requests per day could be fulfilled. 
Understanding that some requests would require more analysis, \\i = \2 products per day 
or 84 products per week. Since the average number of arrivals per time period (k) must 
be less than \|/, a value of 11 products per day (77 products per week) is reasonable. This 
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value for A, is also defendable due to the high operational tempo of a 24 hour taetieal 
intelligenee eell. The standard deviation was eompressed from 45 to 30 minutes, 
meaning a = 0.5 hours (0.00298 weeks). All ealeulations will be in the same units as 
those derived in Chapter II for eomparison purposes. With these values of X, \|/, and a, 
the following six eomputations eneompass the operating eharaeteristics of this model; 


Average server utilization time: 

p = A = 0.917 = 91.7% 

¥ 

Average number of eustomers or units waiting in line for serviee; 

’ 2(1-p) 

Average number of eustomers or units in the system: 

L = L^+p = 6.32 

Average time a eustomer or unit spends waiting in line for serviee: 
L 

W^= — = 0.01 weeks = O.AOdays = 11 .lOhours 

Average time a customer or unit spends in the system; 

W = W^ +(^^) = O.O'&lweeks = 0.51 days = 13.lOhours 

Probability that there are zero customers or units in the system: 

= 0.083 = 8.3% 


(3.1) 

(3.2) 

(3.3) 

(3.4) 

(3.5) 

(3.6) 


From these calculations, it is evident that the queue has been reduced by 
an order of magnitude (hours vice weeks). However, it is not evident that tactical 
intelligence production is a common capability with a queue time of than double what the 
author has determined as acceptable for tactical intelligence production.^ This length of 
time spent in the system (13.76 hours) is a result of assuming that the SIGINT analysts 
will be kept busy with BCD because it will be such a useful tool at the tactical level and 
the stipulation that FIFO is assumed. Any single request in the queue can be fulfilled if 


^ The author has defined taetieally aeeeptable intelligenee as requiring less than six hours to produee. 
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that requirement is time sensitive, disregarding the FIFO requirement. At the taetieal 
level, infrequently would there be more than three time sensitive requests which must be 
fulfilled concurrently^. With an average fulfillment time of 105 minutes, up to three time 
sensitive requests could be fulfilled in order to be considered intelligence driving tactical 
operations. If there are more than three, another geographic location with the BCD 
application could be used to augment the tactical scenario in question. 

B. SUMMARY 

Instead of being situated in a single strategic operations center, BCD will be 
integrated with another program that is utilizing cloud computing as a way to 
geographically separate the required databases which BCD processes. BCD will then 
exist in the application layer of “the cloud.” This will allow multiple users in multiple 
theaters to use BCD regularly without the need to send and RBI to CONUS. BCD 
relocation will lead to the capability to regularly produce tactical level intelligence in 
multiple theaters simultaneously. The database reorganization will occur at both the 
JWICS and SIPRNet levels, permitting access to more users at various clearance levels. 


^ “Tactical level” in this scenario is defined to be at the USMC Battalion level. 
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IV. COMPARISON AND ANALYSIS OF ARCHITECTURES 


A. TIMELINESS OF INFORMATION 

I. Latency Comparison 

Examining both charts (Figure 26) of the eurrent and proposed proeesses side-by- 
side provides a useful visual representation of the magnitude of lateney eliminated from 
the proeess. It is important to note that the proposed arehitecture is an entire order of 
time magnitude (Minutes versus Hours) less than the eurrent arehiteeture. This deerease 
in lateney allows for the produetion of taetieal intelligenee. 

The eombined graph in Figure 26 labeled “Current and Proposed Comparison” 
illustrates the disparity in visual representation when both seenarios are overlaid on the 
same axis in the same unit of measurement. The frequeney of oeeurrenee skews the 
graph beeause there is approximately one hundred percent chanee an RFI will be fulfilled 
within four hours. Compressing the horizontal axis of the proposed proeess forees an 
expansion of the vertieal axis of the same proeess. With this expanded range in 
frequeney, the graph of the eurrent proeess appears to have eompressed horizontally. 
This graph shows the extreme deerease in time required to fulfill an RFI. The dotted 
green lines breakout the proposed proeess and ehanges the units of the horizontal axis to 
minutes. The solid orange lines breakout the eurrent proeess and do not ehange the unit 
of measure of the horizontal axis. 


47 



Totnl Ciin eutPioccss 



Time (Hours) 



Totnl Proposed Process 



1 15 29 43 57 71 85 99 113 127 141 155 169 183 197 

Tim e (Minutes) 


Figure 26. Current (Top) and Proposed (Bottom) Overall Latencies and a 
Comparison of Both Architectures (Middle). 

When analyzing both architectures independent of queuing theory, they can each 
handle the production of one tactical intelligence product. However, the current process 
can only handle a couple of these routinely, and they would be based on the priority level 
of the requesting unit. The proposed solution allows for near continuous production of 
tactical intelligence products, if that is what the tactical commander requires. 
Prioritization of desired intelligence products would be focused in a smaller geographic 
region due to the new location of the BCD application, allowing more tactical operations 
to implement BCD. 
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2. Queuing Comparison 

Not only is the overall timeline compressed, but there are other gains to the 
proposed process architecture. Another important aspect of relocating BCD to a tactical 
intelligence cell focused on a particular theater of operations is observed in the sheer 
volume of requests fulfilled per unit time. This is a function of; 

• Having a single SIGINT analyst focused on the BCD application at any 
time during normal operations. 

• Minimal other daily tasks assigned to the BCD analyst. 

• Operating 24 hours per day, 7 days per week. 


• Bamiliarization of the SIGINT analysts with the BM environment in that 
particular operational theater. 


QUEUING THEORY METRICS 

CURRENT 

PROPOSED 

Average number of arrivals per week. 

20 (Global) 

77 (Theater) 

Average # of people or items served per week. 

21 (Global) 

84 (Theater) 

Average server utilization time. (%) 

95.2 

91.7 

Average # of customers waiting in line for service. 

9.1 

5.4 

Average # of customers or in the system. 

10.05 

6.32 

Average time a customer spends waiting for service. 

3.2 Days 

11.76 Hours 

Average time a customer spends in the system. 

3.5 Days 

13.76 Hours 

Probability that zero customers are in the system. (%) 

4.8 

8.3 


Table 5. Comparison of Queuing Theory Metrics. 


As declared at the end of Chapter III, the proposed timeliness is higher than the queuing 
theory metrics due to the BIBO requirement for an M/G/I system. 
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3. Overall Timeliness Comparison 


Providing BCD to a tactical intelligence cell with a revised operating procedure 
will increase the timeliness of the information flow to the SIGINT analyst. The 
subsequent table compares the two architectures with respect to various metrics. 


COMPARISON 

CURRENT 

PROPOSED 

Does the process require an RFI to CONUS in order 

to begin the process? 

Yes 

No 

Once information is desired, when does the process 

begin? 

When received 

in CONUS. 

Instantly 

What is the average time to fulfill an information 

request from the queue? 

3.5 Days 

13.76 Hours 

How large is an area of interest per ECD location? 

Global 

Operational 

Theater 

In one operational theater, how many requests can 

be worked at once? 

One or Two 

Many 

When a high value operation is planned, how 

quickly can ECD produce actionable intelligence? 

Hours 

< 60 Minutes 

Capable of providing general situational awareness 

to commanders? 

Yes 

Yes 

Capable of routinely assisting tactical operations? 

No 

Yes 


Table 6. Comparison of Tactically Important Metrics. 


There are a few assumptions that allow this table to be accurate. First, it is 
assumed that the analyst at the tactical level has been trained and is familiar with the 
technology. The analysts currently using BCD at the strategic operations center are very 
experienced analysts with decades of operational knowledge in the field. Since BCD 
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would reside in multiple theaters, the analyst in any partieular theater will be familiar 
with the EM environment in that particular area of operations. 

B. INFORMATION GAINED BASED ON UNCERTAINTY 

1. Overview 

Danskin, in his theory of reconnaissance, applies information theory to quantify 
“the optimum distribution of aerial reconnaissance effort against land targets in the 
presence of decoys” (Danskin, 1962). The information gained is a function of the amount 
of reconnaissance effort associated with a given region. Both before and after a 
reconnaissance, the information is quantified using the various probabilities of 
uncertainty coupled with that given region. 

Danskin’s theory was focusing on land targets with probabilities associated with 
them. These probabilities for a given region include: 

Po = There is no target. 

Pj = There is a decoy. 

P 2 = There is a target. 

The summation of these probabilities is one. The different probabilities will be redefined 
based on signals per region. This section will look at Danskin’s theory and apply it to a 
tactical intelligence center with ECD as an organic asset. 

2. Computations 

Transforming Danskin’s theory to the realm of a SIGINT analyst is possible, if 
the right variables are chosen. ^ Before proceeding with this transformation to the ECD 
application, a few assumptions and understandings need to be stated. The SIGINT 
environment deals with many probabilities based on collection assets and techniques to 
include the probability of false negative (or false detection), the probability of intercept, 
and the probability of not locating the target. These probabilities are resident, and will 
continue to reside with ECD applied to the signals data and are not discussed or 

^ All equations in this section, unless otherwise noted, come from Danskin’s “A Theory of 
Reconnaissance: I.” 
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accounted for in this analysis. BCD does not alter the data eollected. All issues 
assoeiated with the collected data do not dissipate. BCD is merely another way to 
examination and filter a signals database. It is not the intent of this analysis to ehallenge 
any teehnieal analysis of signals and/or the probability related to the technical analysis of 
signals. The following probabilities are simply related to the output of BCD overlaid on a 
geographie region. 

The computations begin with the uncertainty of a region and probability 
associated with this uncertainty. There is a signal probability associated with each 
region, p., where: 


—bJ = i 

i 

Bor BCD these can be redefined as: 

Po = There is no signal. 

Pj = There is a signal of interest (SOI). 

P 2 = There is a signal not of interest (SNOI). 

In this scenario, po + Pi + P 2 = 1 • 

The uncertainty for a given region before any reconnaissance is defined as: 

U(Po,PvP2) = -CY,\-Pi log2(B,)] (4.1) 

/=o 

After the reeonnaissanee is conducted, the probabilities will differ from those before the 
reeonnaissance. A probability after reconnaissance is notated as p \. The uncertainty for 
a given region after reconnaissance is defined as: 

V{p\,p\,p\) = -CYj,p\\og,{p\)] (4.2) 

1=0 

Bor this thesis represents the probabilities of uncertainty prior to the utilization of BCD. 

The probability after the utilization of BCD is denoted as p \ . The worst ease seenario is 

when all the probabilities are relatively equal; meaning po = Pi = P 2 = (1/3). When these 
three probabilities are equal, uncertainty is maximized because no leverage can be given 
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to either deeision. In this ease, U{p^,p^,p 2 )= 0.477*C. On the opposite end of the 

speetrum, a case where po = 0.001, pi = 0.001, and p 2 = 0.998 produces a low uncertainty 
of 0.0069*C. Here, there is a very high certainty that p 2 is the solution. 

The information gained concerning a particular region is the function I(x) where x 
equals the amount of effort devoted to that region. Danskin defines the information 
gained from a reconnaissance as the uncertainty after the reconnaissance subtracted from 
the uncertainty before the reconnaissance, or: 

I{x)^U{p^,p„p^)-U{p\,p\,p\) 

I(x) can be rewritten as: 

I{^) = -CY,\-Pi log2(A)] + CX[P'; log2(P',)] (4.3) 

(=0 /=0 

This value of I(x) is referred to as “the entropy of a finite scheme” (Khinchin 1957) 
equating the amount of uncertainty to information entropy. 

The uncertainty example above, where U{pQ,p^,P 2 )= 0.477*C, can demonstrate 
how the information will increase. Take the scenario with a very low uncertainty as the 
probabilities associated with a region after the reconnaissance (or Post-ECD). This 
would mean p’o = 0.001, p’l = 0.001, and p ’2 = 0.998 yielding U{p\,p\,p'f) = 

0.0069*C. In this case I{x)-U{pQ,p^,p 2 )-U{p\,p\,p\)= 0.477*C - 0.0069*C = 

0.47*C. The scenario takes a region of high uncertainty, filters it, and produces a region 
of very low uncertainty that yields a high uncertainty differential with an informational 
output value multiplied by some constant. 

With respect to ECD, represents the probabilities of uncertainty prior to the 

utilization of ECD. The probability after the utilization of ECD is denoted as p \ . This 

equates to the amount of information gained depends the amount of uncertainty in the 
region eliminated by ECD. SIGINT analysts want to decrease uncertainty; however, they 
want to decrease it in a certain way. Concerning the probability of signals, the analysts 
want to maximize the combination of po and pi and minimize p 2 . The situation above, 
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where p 2 was maximized, is useless to a SIGINT analyst because that means that most of 
the signals on the map are SNOIs. If most signals are not of interest, the analyst must 
still allocate man hours searching for SOIs. 

3. Selected Scenarios 

The following two scenarios will quantify the information gained using BCD. 
The first scenario is dedicated to a region that is densely populated. A sparsely populated 
region is the focus of the second scenario. Appendix D shows the Microsoft Excel 
spreadsheet with the calculations and formulas for both of the following scenarios. 

a. Densely Populated Region 

Consider a highly populated geographical area, most likely a major city. 
Now consider the amount of signals jammed into this relatively small geographical 
location. A snapshot in time of the EM environment in a major populated area is 
obviously difficult for a SIGINT analyst to tackle due to the vast number and types of 
signals in a small region. Binding an SOI is extremely difficult. 

In this setting, po would equal zero. Since the logarithm function of zero 
is undefined, this terms falls out of the summation. Now it is paramount to consider the 
probabilities of SOIs versus SNOIs. It is assumed that a major city will have a very small 
number of SOIs as compared to SNOIs simply because most of the population is not 
communicating a signal considered interesting to a SIGINT analyst. This assumption 
allows Pi to be extremely low compared to p 2 . The probability of an SOI is set at less 
than one percent, or pi = 0.005 generating p 2 = 0.995 since the po + Pi + P 2 = 1- 

After running ECD on this geographic area, the result is a less cluttered 
snapshot of the EM environment. Since ECD eliminates the redundant signals, the value 
of p\ will increase. This increase will yield an increase in /?\also because the 

redundant signals tend to be SNOIs vice SOIs. Taking the following values of p \ : 

p',=0A0 
p\=om 
p ’2 =0.59 
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Inserting these values^ into equation (4.3) produees I(x) = (-1.0)*C. 

These results are eounterintuitive due to the negative value assoeiated with 
the ealeulations. Given that, the overall uneertainty is increasing, then the information 
gained is decreasing. This is beeause BCD deereased the probability of a signal being of 
non-interest viee one of interest. For the SIGINT analyst, an inerease in po + pi and a 
deerease in p 2 is the desired situation. Within a speeifie region, the amount of area where 
there are no signals (po) means there is less area to evaluate and a greater ehanee that a 
known signal is one of interest. 

In this seenario, forty pereent of the map does not eontain a known signal. 
This eliminated SNOIs and inereased the probability of an SOI to two pereent, with the 
remaining fifty-eight pereent being SNOIs. The probability of desired outeomes before 
BCD (po + pi) and after BCD (p’o + p’l) went from less than one pereent to 
approximately forty-two pereent. Overall, the information gained deereased beeause the 
uneertainty in the environment inereased, but the uneertainty of an SNOI also deereased, 
whieh is a desired objeetive of BCD. 

b. Sparsely Populated Region 

Now eonsider a sparsely populated geographieal area, a small village in 
the middle of a barren region. Now eonsider the minuseule amount of signals in this 
region (eompared to a major eity). A snapshot in time of the EM environment in this 
seenario is not as diffieult for a SIGINT analyst to taekle as in the previous example. 
However, a SIGINT analyst must eonsider all loeations where an SOI eould appear. The 
faster an analyst ean filter through a region of this nature, than the faster that analyst ean 
undertake areas of dense population. 

In this setting, there is a seventy pereent ehanee that there is not a signal in 
a partieular area, po = 0.7. Now eonsider the probabilities of SOIs versus SNOIs. It is 
assumed that a thinly populated area of interest will have few SOIs as eompared to 

^ All values of Pi and p’i in both scenarios are arbitrary and based purely on the author’s experience 
with a few BCD final products. The values will vary based on geographic region and situation; however, 
the relationship between the probabilities will be similar. This is important because quantifying the 
information gained depends heavily on both geographic region and situation. 
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SNOIs; but not as few as a major city. The probability of an SOI is set at five percent, or 
Pi = 0.05 generating p 2 = 0.25 since the po + pi + pi = 1 • 

After running BCD on this geographic area, the result is an even less 
cluttered snapshot of the EM environment. Since BCD eliminates the redundant signals, 
the value of p 'q will again increase. As before, this increase will yield a slight increase 

in/?'jalso because the redundant signals tend to be SNOIs vice SOIs. Taking the 
following values of p \: 

p’o =0.85 
p’l =0.055 
p ’2 =0.095 

Inserting these values into equation (4.3) produces I(x) = (0.32)*C. 

These results are more intuitive than the previous example due to the 
positive value of information gained. Given that, the overall uncertainty is decreasing, 
then the information gained is increasing', opposite of the previous scenario. Just like 
before, the amount of area where there are no signals (po) means there is less area to 
evaluate and a greater chance that a known signal is one of interest in a specific region. 

In this scenario, eighty-five percent of that region does not contain a 
known signal. This eliminated SNOIs and increased the probability of an SOI by only 
one-half of a percent. The probability of desired outcomes before BCD (po + pi) and 
after BCD (p’o + p’ 1 ) went from seventy-five percent to just over ninety percent. Overall, 
the information gained increased because the uncertainty in the environment decreased, 
and the uncertainty of an SNOI also decreased, which once more is a desired objective of 
the BCD application. 

4. Summary 

Applying BCD to a given region can be compared to conducting an aerial 

reconnaissance over land targets. Quantifying the amount of information gained based 

on the level of uncertainty shows an increase in the summation of the probability of no 

signal and the probability of an SOI. A negative or positive value, based on scenario, 
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will determine the level of inerease of information. This quantified value will change 
based on geographic location, situation, and mission to be accomplished. Of importance 
is the relative decrease in the probability of an SNOI. 

C. TIME GAINED BASED ON UNCERTAINTY 

1. Overview 

Determining the level of uncertainty is a necessary step to understanding the EM 
environment within a given region. A SIGINT analyst requires a certain amount of time 
to analyze a given geographic region in order to fully understand the EM environment. 
Understanding this environment well will aid commanders in making decisions to 
accomplish their mission. This analysis consumes a certain amount of the analyst’s time. 
As seen in the previous section, a reduction in uncertainty leads to an increase in the 
amount of information provided. This section calculates how this same reduction in 
uncertainty will condense the amount of time necessary to locate an SOI. 

2. Scenario 

As a SIGINT analyst begins analyzing a new region, the level of uncertainty is 
high. Over time, that level of uncertainty decreases to an acceptable level. Determining 
what defines an acceptable level is situational dependent. Assumed in this analysis is a 
linear relationship between the level of uncertainty and time spent on analysis. The slope 
of this line is dependent on various characteristics to include the analyst’s expertise, 
operational environment, and mission. 

The following chart represents a scenario where there is initially a very high level 
of uncertainty in the EM environment. Over time, the analyst filters out the unnecessary 
information to point where he/she is comfortable with the operating environment. This 
level of uncertainty is assumed to be 0.1, or ten percent and is indicated by a green 
dashed line in the chart. 
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Level of Uncertainty Before ECD 
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- Ell vii onnient Before ECD 


Figure 27. Environmental Uneertainty Prior to ECD. 


Running ECD will alleviate a pereentage of (redundant) signals in the operating 
environment. Eliminating these signals leads to an overall lower initial level of 
uncertainty in that environment. It is important to note that there are no claims being 
made that ECD will speed up a SIGINT analyst’s ability to analyze a given environment. 
This is visually depicted in the equal slopes of the lines on the charts. What is simply 
being stated is that the initial conditions of that operating environment are altered due to 
ECD by decreasing the level of uncertainty in that region, as shown in Eigure 28. 
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Overlaying the two charts shows that the slopes remain constant. The only 
difference is the starting baseline for the analysis of that environment. Like the previous 
two charts, the green dashed line represents the minimum acceptable amount of 
uncertainty for a given region. 


Environment Comparison 



— Envii oninent Before ECD 
Envii oninent After ECD 


Figure 29. Environment Comparison Before and After ECD. 


3. Summary 

One can see that with the application of ECD, less time is required to analyze a 
given environment. The At, or change in analysis time, is dependent on the decrease in 
the level of uncertainty and slope of the analyst’s uncertain line. An important 
assumption to validate the previous statement is the linear relationship between 
uncertainty and analysis time. Decreasing this time interval is paramount to the quicker 
completion of a commander’s OODA loop. 


D. VISUAL REPRESENTATION OF INFORMATION PROVIDED TO THE 
TACTICAL COMMANDER 

This section is located in a classified appendix. 
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V. CONCLUSIONS AND RECOMMENDED EUTURE WORK 

A. CONCLUSIONS 

SIGINT analysts are constantly overwhelmed by the amount of data they ingest 
and BCD was fashioned in order to alleviate a portion of the “background noise,” or 
signals of non-interest. BCD has been tested and its operational capability verified and 
validated by senior analysts. With the current organizational structure within which BCD 
resides, its utility to the tactical user is limited. This limitation affects both the timeliness 
of intelligence production and volume of users it can accommodate. An analytical model 
was devised to determine the sources of latency in response to a request for information 
(RBI). Various obstacles are highlighted and a revised operating procedure was modeled. 

This thesis analyzes four aspects of an organization (task, technology, structure, 
and actors) and proposes a change in BCD implementation to affect the production of 
tactical intelligence. The intent of the revision, along with providing BCD to a tactical 
intelligence cell, is to allow the tactical commander to make more effective decisions 
with respect to the employment and deployment of forces, types of forces (kinetic versus 
non-kinetic) to employ, and maximizing the efficiency of organic intelligence collection 
assets. The organizational revision, coupled with required analyst training, allows 
information to be pushed to a tactical intelligence cell and commander within a window 
of six hours from collection of the signal. This window allows for the production of 
actionable intelligence, increases the efficiency of SIGINT analysts, and potentially 
drives tactical operations. 

In order to effectively enhance a tactical commander’s decision-making process, 
the OODA loop timeline must be condensed while provide the same, if not more, 
information. BCD is proven to increase the amount of information gained by decreasing 
the uncertainty of information within a given region. This decrease in uncertainty, with 
all other parameters being equal, decreases the amount of time required to understand the 
BM environment in a given scenario. As BCD positively affects uncertainty and 
timeliness, the tactical commander’s first two steps (observe and orient) in the OODA 
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loop condense, allowing deeisions to be made faster and aetions to oeeur faster. 
Condensing the OODA loop enough will foree an adversary to be reaetive viee proaetive 
to eoalition operations. 

B. TACTICAL APPLICATION 

BCD has passed all initial experimentation, verifieation, and validation^ and is 
eurrently operational on a small seale at a strategie operations eenter. The best way to 
test the effeetiveness at the taetieal level is to integrate BCD with a unit who has previous 
operational experienee in support of OIB and/or OBB and will deploy in support of OIB 
and/or OBB in the near future. Personnel who have deployed both with and without BCD 
teehnology will measure the taetieal usefulness and effeetiveness. 

The author has seleeted B* Radio Battalion (IstRadBn) loeated at Camp 
Pendleton, California as the taetieal unit with whieh to evaluate and assess the usefulness 
of BCD at the battalion level. This seleetion was based on; 

1. The author’s familiarity with the integration of a Radio Battalion in 
Marine Air Ground Task Boree (MAGTB) operations. 

2. The operational tempo of deployments in support of OIB by IstRadBn. 

3. The operational experienee of IstRadBn leadership and SIGINT analysts 
alike in support of OIB. 

4. The geographie loeation of IstRadBn with respeet to the NPS.i*’ 

Personnel interviews were eondueted with IstRadBn in order to diseuss with 
SIGINT experts the utility of this teehnology and its effeets on battalion operations. The 
effeets were viewed as positive. Ideally, BCD will be implemented in an upeoming 
deployment in support of OIB or OBB. 


9 Details of all experimentation, verification, and validation are classified. 

It is not the intent of the author to conclude that any bias has been given to IstRadBn over the other 
Radio Battalions based on performance. For the purpose of thesis research, funding was allotted for travel 
within California, making IstRadBn the optimal tactical unit to select. 
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IstRadBn and the author agreed to use a past operational signifieant event as a 
template for trend analysis. Analyzing the situation with BCD, ineluding the events that 
led up to the significant event and possible tippers of its occurrence, will demonstrate a 
noteworthy capability BCD would provide to IstRadBn. The true value of BCD will only 
be realized once provided to a tactical unit conducting real-world operations with a 
defined and distinct situation and mission. 

C. RECOMMENDED FUTURE WORK 

Several areas of future research and work have been identified throughout the 
creation of this thesis. They are: 

• Derive an alternate evaluation method, involving conditional entropy, 
which is “entropy of a random variable, given another random variable” 
(Cover, 1991). 

• Identify quantifiable evidence of proper decision-making based on BCD. 

• Quantify the utility of BCD with respect to maximizing organic 
intelligence collection assets at the tactical level. 

• Analyze the utility and information gained (cost-benefit analysis) of 
providing BCD on both JWICS and SIPRNet. 

• Continue end-user collaboration with Radio Battalion, USMC with the 
intent of: 

o evaluating real-world operational tests (Pre- and Post-BCD). 

o Reassessing best/most-practical implementation practices. 

o Continuing revision of operating procedures from lessons learned 
via operational testing. 

o Outlining and implementing an BCD application training plan. 

• Analyze the effect of BCD at the MAGTB Commander level with 
implementation at a Radio Battalion. 
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APPENDIX A. CURRENT PROCESS DIAGRAM 


The following is a typical path in the RFI submittal process. The process begins 
with the observation of an intelligence gap. 


RFI Submission 


• Inlclligcncc gap observed. 

• Requirement identified. 

• Rl'l submitted. 



Once the RFI reaches the U.S. (CONUS), it is placed in a queue and resides there until an 
analyst begins to process the RFI. The next diagram is characteristic of the information 
flow between analysts. 
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A simplistic visualization of this process is as follows. 


0 

Ana^n 



Once the finalized report is properly formatted, the RFI is sent baek to its originator. 


RPI Fulfillment 



• Dual motion process. 

- Requires a “push” from CONUS. 

- Requires a knowledgeable “pull” 
from theater. 


The rest of the process resides in the theater of operations. At this time in the process, it 
is necessary to consider what rework (if any) is required. 
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RFI REWORK/RESUBMIT REQUIRES CYCLE TO BEGIN ANEW THROUGH CONUS 


In Theater Process 
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APPENDIX B. CURRENT PROCESS HOURLY PROBABILITY 




4pm (start pure Sun) 


3pm 



midnight (Sat/Sun) 


11pm (Sat) 


10pm 


9pm 


8pm 


7pm 


6pm_ 


5pm 


10 

11 

11 

12 

12 

13 

13 

14 

14 

15 

15 

16 

16 

17 

17 

18 

18 

19 

19 

20 

20 

21 

21 

22 

22 

23 

23 

24 

24 

25 

25 

26 

26 

27 

27 

28 

28 

29 

29 

30 

30 

31 

31 

32 

32 

33 

33 

34 

34 

35 

35 

36 

36 

37 

37 

38 

38 

39 


Probability 

of 

Occurrence: 

P(X) 

Expected 

Vaiue: 

E(X) 

Popuiation 

Variance: 

V(X) 

0.327380952 

0.327381 

58.9831465 

0.029761905 

0.0595238 

4.59290071 

0.029761905 

0.0892857 

3.88322101 

0.029761905 

0.1190476 

3.23306511 

0.029761905 

0.1488095 

2.64243303 

0.029761905 

0.1785714 

2.11132475 

0.029761905 

0.2083333 

1.63974028 

0.029761905 

0.2380952 

1.22767963 

0.029761905 

0.2678571 

0.87514278 

0.029761905 

0.297619 

0.58212974 

0.029761905 

0.327381 

0.34864051 

0.029761905 

0.3571429 

0.17467509 

0.029761905 

0.3869048 

0.06023348 

0.029761905 

0.4166667 

0.00531568 

0.005952381 

0.0892857 

0.00198434 

0.005952381 

0.0952381 

0.0148103 

0.005952381 

0.1011905 

0.03954103 

0.005952381 

0.1071429 

0.07617651 

0.005952381 

0.1130952 

0.12471676 

0.005952381 

0.1190476 

0.18516178 

0.005952381 

0.125 

0.25751155 

0.005952381 

0.1309524 

0.34176608 

0.005952381 

0.1369048 

0.43792538 

0.005952381 

0.1428571 

0.54598944 

0.005952381 

0.1488095 

0.66595826 

0.005952381 

0.1547619 

0.79783184 

0.005952381 

0.1607143 

0.94161019 

0.005952381 

0.1666667 

1.09729329 

0.005952381 

0.172619 

1.26488116 

0.005952381 

0.1785714 

1.44437379 

0.005952381 

0.1845238 

1.63577119 

0.005952381 

0.1904762 

1.83907334 

0.005952381 

0.1964286 

2.05428026 

0.005952381 

0.202381 

2.28139193 

0.005952381 

0.2083333 

2.52040837 

0.005952381 

0.2142857 

2.77132958 

0.005952381 

0.2202381 

3.03415554 

0.005952381 

0.2261905 

3.30888627 

0.005952381 

0.2321429 

3.59552175 


NORMALIZED 

0.017049084 

0.017797419 

0.018516944 

0.019201623 

0.019845538 

0.020442979 

0.020988519 

0.021477106 

0.021904132 

0.022265511 

0.022557742 

0.022777964 

0.022924007 

0.022994421 

0.022988507 

0.022906324 

0.022748688 

0.022517161 

0.022214025 

0.021842242 

0.021405407 

0.020907693 

0.02035378 

0.019748784 

0.019098179 

0.018407717 

0.017683336 

0.016931086 

0.016157039 

0.015367211 

0.014567488 

0.013763555 

0.012960833 

0.012164423 

0.011379062 

0.010609081 

0.009858376 

0.00913039 

0.008428099 

























































































































































































































































3pm 

39 - 40 

1 

0.005952381 

0.2380952 

3.894062 

0.007754008 

2pm 

40 - 41 

1 

0.005952381 

0.2440476 

4.20450701 

0.007110157 

1pm- 

41 - 42 

1 

0.005952381 

0.25 

4.52685679 

0.006498131 

noon 

42 - 43 

1 

0.005952381 

0.2559524 

4.86111132 

0.005919078 

llam 

43 - 44 

1 

0.005952381 

0.2619048 

5.20727062 

0.005373732 

10am 

44 - 45 

1 

0.005952381 

0.2678571 

5.56533468 

0.00486244 

9am 

45 - 46 

1 

0.005952381 

0.2738095 

5.9353035 

0.004385195 

Sam 

46 - 47 

1 

0.005952381 

0.2797619 

6.31717708 

0.003941666 

7am 

47 - 48 

1 

0.005952381 

0.2857143 

6.71095543 

0.003531239 

6am 

48 - 49 

1 

0.005952381 

0.2916667 

7.11663853 

0.003153049 

5am 

49 - 50 

1 

0.005952381 

0.297619 

7.5342264 

0.00280602 

4am 

50 - 51 

1 

0.005952381 

0.3035714 

7.96371903 

0.002488897 

3am 

51 - 52 

1 

0.005952381 

0.3095238 

8.40511642 

0.002200288 

2am 

52 - 53 

1 

0.005952381 

0.3154762 

8.85841858 

0.001938691 

lam 

53 - 54 

1 

0.005952381 

0.3214286 

9.32362549 

0.001702526 

midnight (Fri/Sat) 

54 - 55 

1 

0.005952381 

0.327381 

9.80073717 

0.001490169 

11pm (Fri) 

55 - 56 

1 

0.005952381 

0.3333333 

10.2897536 

0.00129997 

10pm 

56 - 57 

1 

0.005952381 

0.3392857 

10.7906748 

0.001130284 

9pm 

57 - 58 

1 

0.005952381 

0.3452381 

11.3035008 

0.000979486 

8pm 

58 - 59 

1 

0.005952381 

0.3511905 

11.8282315 

0.00084599 

7pm 

59 - 60 

1 

0.005952381 

0.3571429 

12.364867 

0.000728263 

6pm 

60 - 61 

1 

0.005952381 

0.3630952 

12.9134072 

0.000624839 

5pm 

61 - 62 

1 

0.005952381 

0.3690476 

13.4738523 

0.000534323 



168 


14.42262 

300.82735 












Standard Deviation = 

17.344375 

hrs 




= 

17 hrs 21 

mins 
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APPENDIX C. SENIOR EXECUTIVE PRESENTATION 



Captain Derek Filipe, USMC 

• B.S. Mechanical Engineering, The 
George Washington University, 2003 

• Pursuing: 

- M.S. in Systems Technology 

- M.S. in Space Systems Operations 

• OPERATION: ENDURING FREEDOM 

- Intelligence Officer, HMH-462 

- Sep 2004 - Mar 2005 

• OPERATION: IRAQI FREEDOM 

- Intelligence Advisor, Iraqi Border Patrol 

- Apr 2006-Apr 2007 


FOCUS AREAS 

• Organizational Analysis 

• Command & Control Analysis 

• Tactical Dissemination Analysis 

METHODS 

• Quantitative Analysis 

• End-User Collaboration 

• Personnel Interviews 

• Operational Testing 


ENDSTATE: OPTIMIZATION OF INFORMATION FLOW TO 

TACTICAL LEVEL 


UNCLASS/Zroiio 



Energy Change Detection 

If Energy Change Detection (ECD) is provided to a tactical 
intelligence cell with a revised operating procedure, then 
the potential for more effective decision-making by the 
tactical commander exists, allowing said commander to 
make more informed decisions on: 

• Employment and deployment offerees. 

• Which type (kinetic versus non-kinetic effects) of 
forces to employ. 

• How to maximize the utilization of organic 
intelligence collection assets. 



UNCLASS//FOUO 
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Approach 


W' 


• Work with the analysts to be able to effectively 
model the current employment of ECD. 

• Identify pitfalls and sources of latency in the 
current model. 

• Propose a new operating procedure for ECD. 

- Implement and test. 



UNCLASS//FOUO 



Current ECD Process 


• Process initiated once RFI submitted. 

- Observation of an intelligence gap. 

- Requirement identified. 

- "Push-and-Pull" system. 

• Large disparity in time interval once RFI submitted. 

- Dependent on CONUS workday. 

• End User not familiar with process. 

- Does not know what to ask for. 

- Does not fully understand the capabilities. 

- Cannot submit RFI until the requirement exists. 



UNCLASS//FOUO 
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W' 


Current Process 

• Phase 1: RFI Submittal 

- Intelligence gap observed. 

- Requirement identified. 

- RFI submitted. 





Queuing Calculations 


Characteristics of (M/G/1) System 

Current Process I 

Average number of RFIs received per week (Based on 
Flistorical Data). 

20 

Maximum service rate (Number of RFIs per week). 

21 

Percent utilization. 

95 

Number of RFIs in the queue. 

9.1 

Number of RFIs in the system. 

10 

Average time spent waiting in the queue per RFI (days). 


Average time spent in the system per RFI (days). 


Percentage that there are no RFIs in the system. 

5 




UNCLASS//FOUO 
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W' 


Current Problem Areas 


• Potential sources of latency. 


1. Information versus intelligence. 

2. "Pushing" vs. "Pulling" information. 

3. Bottleneck. 

4. Human-in-the-loop. 

5. Clearance and access. 
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Proposed Solution 


• ECDonSIPR. 


- SI/TK versus functionality. 

• KMLs "pushed" to all users. 

- Geo-Filtered reports. 

- 4 hour time intervals, tactically acceptable. 

- Historic reports useful for trend analysis. 

• Eliminates the RFI submittal process. 

- Instant access upon requirement realization. 


• Removal of the Human-in-the-loop. 



Human needed for analysis, not information push. 
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Preliminary Conclusions 


• Time to fully implement this technology. 

- Ready for Full Operational Capability. 

- Clear and present utility at the tactical level. 

- High potential to drive operations. 

• Reside on either SI/TK system and/or SIPRNET. 

- Pros and Cons analysis of residing on both. 

- Database storage concerns require analysis. 

• End User familiarization necessary. 
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Forward 



• Technology implementation. 

- Collaboration with Mr. John Abe. 

- Database familiarization. 

• End User collaboration. 

- Radio Battalion, USMC. 

- Camp Pendleton, CA. 

- Potential for real-world operational testing. 

- Reassessment of best/most-practical implementation. 

- After Action Reports / Lessons Learned. 

- Revision of operating procedures. 
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Implications 



Intelligence Cell 


More Effective Decision-Making 




Energy 
Change 
, Detection . 



1. Effective employment and deployment of forces. 




V 


J 2. Correct determination of types of forces to employ. 


3. Better focused organic intelligence collection assets. 


• Provides a tool to the tactical commander useful in asymmetric conflict. 

• Adversary does not know we have this capability. 

- Cannot defend against it. 

- Cannot use Camouflage, Denial, or Deception to defeat it. 

• Compels the adversary to be REACTIVE vice PROACTIVE. 
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APPENDIX D. SCENARIO CALCULATIONS AND EORMULAS 


l(x) = Information gained concerning a particular region 

x= Amount of effort devoted to that region 

(x is constant with respect to ECD) 

There is uncertainty associated with each signal. 

P0= There is no signal 

Pl= Signal of I nterest (SOI) 

P2= Signal Not of I nterest (SNOI) 

P0+P1+P2 = 1 


Uncertainty for 1 region: U(P0,P1,P2)= -c[SUM(Pi log Pi)] 


Uncertainty as a result of ECD: U(P'0, 

The information produced by ECD: 

l(x) = U(P0,P1,P2) - U(P'0, P'1, P'2) 

P'1, P'2)= -c[SUM(P'i log P'i)] 

SCENARIO 1: DENSELY POPULATED REGION 

o 

II 

o 

Q. 

d 

II 

o 

Q. 

Pl = 0.005 

P'l=0.01 

P2 = 0.995 

P'2=0.59 

U(P0,P1,P2) = 

0.045414692 c 

U(P'0, P'1, P'2) = 

1.044325553c 

l(x) = -0.998911c 



SCENARIO 2: SPARSELY POPULATED REGION 

d 

II 

o 

Q. 

P'0=0.85 

Pl = 0.05 

P'l=0.055 

P2 = 0.25 

P'2=0.095 

U(P0,P1,P2) = 

1.076297626c 

U(P'0, P'1, P'2) = 

0.752052041c 

l(x) = 0.3242456c 
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